Industrial control systems aren’t “IT with buttons.” OT environments run physical processes where a well-meaning scan can crash a PLC, a patch can trip a safety interlock, and a remediation change can cause a production outage. That’s why vulnerability assessment for OT needs to be part engineering, part risk management and heavily constrained by process-safety thinking.
Why OT vulnerability assessments must be safety-aware
In IT, vulnerability scanning + patching is a well-rehearsed loop. In OT, that loop can be lethal:
- Many ICS devices are fragile; active probing can crash devices or HMI displays.
- Patching windows are scarce and often require physical intervention, engineering sign-offs and safety validation.
- Vulnerabilities have physical consequences: loss of observability, unsafe actuations, or production loss.
- OT environments include proprietary protocols (Modbus, DNP3, IEC 61850, OPC UA) and vendor-specific function codes that require domain expertise to interpret.
An effective OT vulnerability assessment provider must therefore combine non-invasive discovery, control-logic awareness, and operationally realistic remediation guidance. If a provider treats OT like IT, stop the conversation.
How to evaluate and scope an OT vulnerability assessment
Before you shortlist vendors, be crystal clear about scope and constraints. Use this quick evaluation checklist internally:
- Objective & Output: Do you want an inventory + CVE list, a risk-scored vulnerability assessment, or an engineering remediation package with tested fixes?
- Active vs Passive: Insist on passive asset discovery first. Active checks are acceptable only after OT validation and on limited targets.
- Standards Mapping: Require mapping to IEC 62443, NIST SP 800-82, and any sector-specific rules (NERC CIP, NIS2).
- Safety Controls: Ask for explicit safety and abort procedures, and a test plan for any active test.
- Vendor & OEM Coordination: Will the assessor coordinate with OEMs for safe update paths? (This reduces risk and friction.)
- Deliverables: Inventory, vulnerability mapping, risk scoring (safety/availability impact), remediation playbook with maintenance windows, and operator handover.
- Skills & References: Ask for references in your sector with similar PLC families and HMI stacks.
Scoping tip: break the assessment into pilot → remediation test → scaled assessment. This reduces risk and builds trust with the OT team.
Selection criteria I use as an OT architect
When I evaluate providers I weight the following heavily:
- OT domain expertise (control systems engineers on the team).
- Non-invasive discovery capability (passive sensors, protocol parsers).
- Risk scoring that includes process safety and availability, not just CVSS scores.
- Integration with change control and ability to produce maintenance-window-aware patches/rollbacks.
- Supply-chain validation (SBOM and firmware provenance checks).
- Ability to validate remediation in a testbed or digital twin before production rollouts.
- Clear, operator-oriented documentation (runbooks and rollback scripts).
Now – the list you came for.
Best 15 Vulnerability Assessment Services for OT (2026 edition)
Note: Providers are listed with suggested “best for” fits. All deliver industrial assessments; choose based on your culture, vendor mix and risk appetite.
1. Dragos – OT-native, threat-led vulnerability assessment
Why pick them: Dragos is built on ICS threat intelligence and pairs passive discovery with an OT risk model. Their reports focus on exploitable attack paths and attacker techniques rather than long CVE lists.
Best for: Utilities, critical infrastructure, organizations seeking adversary-centric prioritization.
2. Claroty – XIoT discovery + pragmatic vulnerability management
Why pick them: Claroty combines deep visibility with vulnerability prioritization that factors in asset criticality and exposure. Strong for brownfield sites with many undocumented devices.
Best for: Large brownfield estates with high device diversity.
3. Shieldworkz – Engineering-led vulnerability assessment & remediation
Why pick them: Shieldworkz emphasizes an engineering-first approach: control engineers validate findings and create vendor-safe remediation steps. They are adept at legacy environments and translate vulnerability findings into practical operational actions.
Best for: Sites with legacy PLCs, complex vendor access paths, and where operator trust is essential.
4. Nozomi Networks – Network-centric inventory and vulnerability surfacing
Why pick them: Nozomi’s Guardian sensors create robust passive inventories and spot configuration anomalies that often mask CVE risk. They pair monitoring with focused assessment services.
Best for: Organizations wanting continuous discovery + assessment integration.
5. Tenable (Tenable.ot) – Vulnerability mapping with CVE depth for ICS components
Why pick them: Tenable brings its vulnerability-management pedigree to OT, mapping CVEs to asset firmware and providing validation tests. Useful when you need a vulnerability posture baseline tied to CVE governance.
Best for: Compliance-driven programs and CVE/Risk management integration.
6. Microsoft Defender for IoT (CyberX) – Cloud-oriented assessments with scale
Why pick them: Defender for IoT integrates discovery and vulnerability assessments into Defender XDR. Works well for enterprises standardizing on Microsoft; assessment outputs are cloud-friendly and integrate into Azure workflows.
Best for: Azure-centric enterprises seeking integrated IT/OT visibility.
7. Armis – Unmanaged asset discovery + risk scoring
Why pick them: Armis excels at finding unmanaged and shadow devices – frequently the largest source of unknown vulnerabilities in IIoT scenarios. Their assessments emphasize asset context.
Best for: IIoT-heavy environments and manufacturing sites with guest devices.
8. Forescout – Continuous posture and vulnerability detection
Why pick them: Forescout provides continuous device posture and policy compliance checks, which helps turn one-time assessments into ongoing posture management.
Best for: Organizations that want long-lived posture management after the assessment.
9. NoName/Industrial Security SMEs (regional integrators) – Localized engineering assessments
Why pick them: In many geographies, regional ICS security firms or integrators with deep control-system experience offer the safest route: they understand local vendor ecosystems and language. Look for certified control engineers, not just pentesters.
Best for: Sites with older, vendor-specific stacks and restricted maintenance windows.
10. Mandiant (Google Cloud) – Forensic-grade vulnerability validation & red teaming
Why pick them: Mandiant brings high-end threat emulation combined with vulnerability validation. Use them when you need to validate serious risks in regulated or high-target environments.
Best for: Financially or geopolitically exposed organizations.
11. Siemens – Vendor-aligned assessment for Siemens control estates
Why pick them: Siemens provides manufacturer-specific checks and remediation options that respect OEM procedures – helpful when Siemens PLCs/HMIs dominate the estate.
Best for: Siemens-centric assets and regulated utilities.
12. ABB – Process-industrial vulnerability assessments with lifecycle support
Why pick them: ABB’s focus on energy and process industries means assessments are tailored to availability and safety constraints. They offer remediation engineering under change control.
Best for: Oil & gas, petrochemical, and process industries.
13. Rockwell Automation (Verve) – Manufacturing and Rockwell stack expertise
Why pick them: Rockwell’s services know Allen-Bradley families and FactoryTalk ecosystems, producing assessments that operations will accept.
Best for: Manufacturing plants with Rockwell hardware.
14. Schneider Electric – OT posture assessments for power and distribution
Why pick them: Schneider couples assessments with grid and distribution knowledge – useful for utilities and critical infrastructure.
Best for: Power distribution and smart grid operators.
15. Global Consultancies (Deloitte / Accenture / PwC / KPMG) – Programmatic assessment and remediation planning
Why pick them: Big consultancies combine vulnerability discovery with program design, governance, and procurement support. They are ideal when assessments must feed into an enterprise transformation program.
Best for: Multi-site, program-level compliance and remediation programs.
Procurement questions to include in your RFP
- Discovery method: Do you use passive sensors, active scans, or both? (Explain when active is used and safety controls.)
- Protocol expertise: Which ICS/OT protocols and PLC families are in scope? Provide engineers’ resumes.
- Risk scoring model: How do you combine CVSS, process criticality, and functional safety into a final priority?
- Remediation support: Do you provide tested remediation steps, rollback scripts, or patch validation in a staging cell?
- OEM coordination: Will you coordinate with vendors (Siemens, Rockwell, ABB etc.) for safe updates?
- Deliverables & format: Provide sample reports, remediation runbooks, and evidence packages suitable for auditors.
- Insurance & liability: What liability coverage do you carry if an assessment causes an OT incident?
- Continuous options: Do you provide continuous scanning or integration with monitoring platforms after the assessment?
Pro tip: require a 1-day technical kickoff and a 2–3 day pilot before authorizing full assessments.
Typical timelines and pricing expectations
- Pilot discovery (passive): 2–4 weeks – instruments deployed, traffic baselined.
- Full vulnerability assessment (single site): 4–8 weeks – discovery, validation, and report.
- Multi-site program: 8–20 weeks depending on scale and remediation validation.
- Budget ballpark: USD 20k–75k per single-site assessment; multi-site programs vary (USD 75k–300k+) depending on depth, red-team integration and remediation validation.
Costs vary widely. Higher costs usually reflect engineering time, red-team validation, and vendor coordination.
How to prioritize remediation – a three-axis model
I use a 3-axis prioritization: Safety Impact × Likelihood × Operational Cost.
- Safety Critical (Immediate): Anything that can cause unsafe actuator movement, disable alarms, or bypass emergency stop. Fix immediately under controlled change.
- High (30–90 days): Remote management interfaces, weak auth on engineering workstations, exposed jump hosts, and credentials reused across sites.
- Medium/Low (3–12 months): Governance gaps, long-lead firmware updates, and hardening that requires redesign or capital expenditure.
Always validate fixes in a staging environment. For safety-critical fixes, use an OT change advisory board and include rollback and physical intervention plans.
KPIs to measure assessment and remediation success
- % of assets inventoried vs known asset estate (goal: 95% coverage for critical VLANs)
- Time to remediate safety-critical findings (target: days, not months)
- Mean Time to Detect (MTTD) for OT anomalies after remediation controls implemented
- Reduction in exposed management services (e.g., RDP/SSH visible from enterprise)
- % of firmware/images with validated signature/SBOM
- Number of successful test rollbacks executed (proof of rollback readiness)
Report these monthly to execs and quarterly to the board with narrative impact assessments.
Common mistakes and how to avoid them
- Treating OT like IT. Passive discovery and control-logic awareness are non-negotiable.
- Rushing to active scanning. Always pilot and validate active checks in a testbed.
- Ignoring operator buy-in. The OT team must trust the assessor; include them early.
- Patching without testing. Never push firmware/PLC changes without staged validation.
- Focusing on CVE counts. CVEs are noisy; prioritize based on process impact.
Final checklist (copy/paste for your RFP or procurement pack)
- Passive discovery for 2–4 weeks on critical VLANs
- Pilot assessment with one control cell and rollback validation
- Risk scoring that includes process safety metrics
- OEM coordination plan for firmware and controller fixes
- Operator handover workshop and runbook delivery
- Quantifiable KPIs and remediation SLAs in contract
Closing – vulnerability assessment is an engineering engagement
The best OT vulnerability assessments combine discovery, ICS expertise and pragmatic remediation – not a CVE spreadsheet. If you want to reduce real operational risk, pick a provider with control engineers on staff (or a vendor that partners tightly with your OEM), insist on passive discovery first, pilot changes in a testbed, and measure progress with safety-centric KPIs.